fix(vikunja): run as the mount owner, and drop the docker socket

Found by installing it. Two problems, one fatal and one worse.

The container crash-looped: the image runs as uid 1000, which under
rootless Docker maps to host sub-UID 232071 while the bind mounts are
owned by the install user, so Vikunja died on its first write to
/app/vikunja/files and restarted forever. Its own error message
diagnosed it exactly. Fixed with the existing USER_TAG mechanism the
portal container already uses — 0:0 under rootless (container root IS
the install user on the host), the real uid:gid under rooted — rather
than hardcoding either.

More seriously, the compose mounted the docker socket, copied in from a
template that needed it. A task manager has no business talking to the
daemon, and the socket is root-equivalent access on the host. Removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

containers/vikunja/docker-compose.yml

@@ -9,14 +9,23 @@ services:
     vikunja-service: #LIBREPORTAL|SERVICE_TAG_1|vikunja-service
         container_name: vikunja-service
         image: vikunja/vikunja:latest #LIBREPORTAL|VIKUNJA_VERSION_TAG|latest
+        # The image runs as uid 1000, which under rootless Docker maps to a host
+        # sub-UID that owns nothing — Vikunja then dies on its first write to
+        # /app/vikunja/files and restarts forever. USER_TAG resolves to the
+        # identity that actually owns the bind mounts: 0:0 under rootless
+        # (container root == the install user on the host), the real uid:gid
+        # under rooted.
+        user: "USER_DATA" #LIBREPORTAL|USER_TAG|USER_DATA
         restart: unless-stopped
         hostname: vikunja
         # GLUETUN_OFF_BEGIN
         ports:
             - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
         # GLUETUN_OFF_END
+        # Deliberately NO docker socket mount: Vikunja is a task app and has no
+        # reason to talk to the daemon. Handing it the socket would be
+        # root-equivalent access on the host for no benefit.
         volumes:
-            - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
             # The image presets VIKUNJA_DATABASE_PATH=/db/vikunja.db, so the
             # database lives in /db and uploaded attachments in files/.
             - ./db:/db